npm package
jsonwebtoken vulnerabilities by version
The latest release, 9.0.3 (Dec 4, 2025), has no known vulnerabilities. 6% of last week’s 60.4M downloads went to versions with known vulnerabilities. OSV.dev lists 4 advisories for jsonwebtoken; the newest was published on Dec 22, 2022.
npm (opens in a new tab) describes it as “JSON Web Token implementation (symmetric and asymmetric)”
- Latest release
- 9.0.3
- Dec 4, 2025, no known vulnerabilities
- Downloads last week
- 60.4M
- All versions, from npm
- Advisories on OSV.dev
- 4
- Newest Dec 22, 2022
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable jsonwebtoken
6% of last week’s 60.4M jsonwebtoken downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. jsonwebtoken doesn’t publish support dates we can check.
Newest advisories
The 4 most recently published, with the versions each one affects.
WarningCVE-2022-23541 on OSV.dev (opens in a new tab)GHSA-hjrf-2m68-5959
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
Affects < 9.0.0. Published Dec 22, 2022.
WarningCVE-2022-23540 on OSV.dev (opens in a new tab)GHSA-qwph-4952-7xr6
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
Affects < 9.0.0. Published Dec 22, 2022.
CriticalCVE-2022-23539 on OSV.dev (opens in a new tab)GHSA-8cf7-32gw-wr33
jsonwebtoken unrestricted key type could lead to legacy keys usage
Affects < 9.0.0. Published Dec 22, 2022.
CriticalCVE-2015-9235 on OSV.dev (opens in a new tab)GHSA-c7hr-j4mj-j2w6
Verification Bypass in jsonwebtoken
Affects < 4.2.2. Published Oct 9, 2018.
Which jsonwebtoken do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for jsonwebtoken, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.